On 22 February 2024, the Court of Justice of the European Union released the Advocate General’s opinion on the sale of databases containing personal data within an enforcement proceedings which is considered to be lawful even without data subjects’ consent. According to his opinion, the GDPR governs the operations of the objectives that the court enforcement officer estimates the value of given databases and sells them by public auction. The officer in charge shall be the data controller. Furthermore, the proceedings must produce the “necessary and proportionate measure in a democratic society to achieve one of the objectives of general interest pursued by [the GDPR]”. 

Full text of the opinion: https://curia.europa.eu/juris/document/document.jsf;jsessionid=B15D6A4BEB1551062447831268ABCFAF?text=&docid=283064&pageIndex=0&doclang=EN&mode=req&dir=&occ=first&part=1&cid=3638953

Press release: https://curia.europa.eu/jcms/upload/docs/application/pdf/2024-02/cp240035en.pdf